Webidsupport Webid
17 CVEs affecting Webidsupport Webid. Latest disclosed: 2024-05-22. Critical: 4, High: 3.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-35409 | Critical | 9.8 | 2024-05-22 | WeBid 1.1.2 is vulnerable to SQL Injection via admin/tax.php. |
CVE-2023-47397 | Critical | 9.8 | 2023-11-08 | WeBid <=1.2.2 is vulnerable to code injection via admin/categoriestrans.php. |
CVE-2020-23359 | Critical | 9.8 | 2021-01-27 | WeBid 1.2.2 admin/newuser.php has an issue with password rechecking during registration because it uses a loose comparison to check the identicalness of two pa… |
CVE-2022-41477 | Critical | 9.1 | 2022-10-14 | A security issue was discovered in WeBid <=1.2.2. A Server-Side Request Forgery (SSRF) vulnerability in the admin/theme.php file allows remote attackers to inj… |
CVE-2024-32166 | High | 8.8 | 2024-04-19 | Webid v1.2.1 suffers from an Insecure Direct Object Reference (IDOR) - Broken Access Control vulnerability, allowing attackers to buy now an auction that is su… |
CVE-2018-1000867 | High | 8.8 | 2018-12-20 | WeBid version up to current version 1.2.2 contains a SQL Injection vulnerability in All five yourauctions*.php scripts that can result in Database Read via Bli… |
CVE-2018-1000882 | High | 7.5 | 2018-12-20 | WeBid version up to current version 1.2.2 contains a Directory Traversal vulnerability in getthumb.php that can result in Arbitrary Image File Read. This attac… |
CVE-2019-11592 | Medium | 6.1 | 2019-04-29 | WeBid 1.2.2 has reflected XSS via the id parameter to admin/deletenews.php, admin/editbannersuser.php, admin/editfaqscategory.php, or admin/excludeuser.php, or… |
CVE-2018-1000868 | Medium | 6.1 | 2018-12-20 | WeBid version up to current version 1.2.2 contains a Cross Site Scripting (XSS) vulnerability in user_login.php, register.php that can result in Javascript exe… |
CVE-2014-5114 | | 2014-07-29 | WeBid 1.1.1 allows remote attackers to conduct an LDAP injection attack via the (1) js or (2) cat parameter. | |
CVE-2014-5101 | | 2014-07-25 | Multiple cross-site scripting (XSS) vulnerabilities in WeBid 1.1.1 allow remote attackers to inject arbitrary web script or HTML via the (1) TPL_name, (2) TPL_… | |
CVE-2010-4873 | | 2011-10-07 | Cross-site scripting (XSS) vulnerability in confirm.php in WeBid 0.8.5 P1 allows remote attackers to inject arbitrary web script or HTML via the id parameter. | |
CVE-2011-3815 | | 2011-09-24 | WeBid 1.0.0 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error messag… | |
CVE-2008-7119 | | 2009-08-28 | SQL injection vulnerability in item.php in WeBid auction script 0.5.4 allows remote attackers to execute arbitrary SQL commands via the id parameter. | |
CVE-2008-7118 | | 2009-08-28 | WeBid auction script 0.5.4 stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain SQL query… | |
CVE-2008-7117 | | 2009-08-28 | eledicss.php in WeBid auction script 0.5.4 allows remote attackers to modify arbitrary cascading style sheets (CSS) files via a certain request with the file p… | |
CVE-2008-7116 | | 2009-08-28 | SQL injection vulnerability in the admin panel (admin/) in WeBid auction script 0.5.4 allows remote attackers to execute arbitrary SQL commands via the usernam… |